Carnival Corporation & plc Global Privacy Notice Staff and Crew

Last updated: April 15^th, 2025

Carnival Corporation & plc and its divisions (collectively referred to as “Carnival,” “we,” “our,” or “us”) are a global cruise business with a portfolio of leading cruise brands, including P&O Cruises Australia, Princess Cruises, Carnival Cruise Line, Holland America Line, Seabourn, Cunard Line, P&O World Cruises, AIDA and Costa (“Carnival Brands”).

This Privacy Notice applies to all employees, crew, contractors, temporary staff, external agents, partners, consultants and vendors, including concessions staff on board ships, working on behalf of Carnival (referred to in this Privacy Notice as “Staff and Crew”). We’ve developed this Privacy Notice to explain how your personal information is collected, used, stored, processed, transferred and disclosed by Carnival in order to initiate, manage and execute our contractual relationship with you.

Overview

Your privacy is important to us. We respect the privacy rights of all individuals and we are committed to handling personal information responsibly and in accordance with applicable law. This Privacy Notice explains what personal information Carnival collects, uses, and maintains (collectively “processes“) about you in the operation of its business, how it uses that data, and your rights to that data.

Please note that this Privacy Notice applies to Carnival’s processing of your personal information as a Staff and Crew member. Additional details concerning Carnival’s governance and privacy requirements for Staff and Crew data can be found in internal resources including the Employee Handbook, Information Security Standard, Technology Use and Privacy Policy, Information Governance Policy and all related articles in seafarer’s agreements. This Privacy Notice does not apply to the handling of your personal information by other companies or organizations outside of Carnival brands, such as staffing agencies or benefits providers, who may process your personal information in accordance with their own policies.

This Privacy Notice does not cover your use of Carnival’s consumer products and services as a consumer, outside of your regular employment or assignment with any of the affiliate brands of Carnival. To learn more about Carnival’s data collection practices that cover your use of our products as a consumer, please read our Privacy Policies located on the applicable brand websites.

This Privacy Notice is not intended and shall not be read to create any express or implied promise or contract for employment, for any benefit, or for specific treatment in specific situations. Nothing in this Privacy Notice should be construed to interfere with Carnival’s ability to process Staff and Crew data for purposes of complying with its legal obligations, or for investigations, subject to compliance with internal policy and local legal requirements.

Carnival’s processing of personal information and other Staff and Crew data is in all cases subject to the requirements of local law, internal policy, and any consultation requirements with worker representatives (where appropriate). To the extent this Privacy Notice conflicts with local law in your jurisdictions, local law controls.

What Personal Information We Collect

The data we collect can include the following, but is not limited to:

Name and contact data. Your first and last name, employee identification number, email address, postal address, phone number, photo, beneficiary and emergency contact details, and other similar contact data. Additionally, you may opt to provide additional contact information such as personal email address(es) and/or cell phone number(s).
Demographic data. Your date of birth and gender. We may also collect and process sensitive demographic information about you in accordance with local requirements and applicable law, as described in the Special Categories of Personal Information section below.
National identifiers. Your national ID/passport, residency, visa and work permit status, social security number, tax file number, or other taxpayer/government identification number.
Employment details. Your job title/position, office location, employment contract, offer letter, hire date, termination date, performance history and disciplinary records, leave of absence, sick time, and vacation/holiday records.
Spouse/partner and dependents’ information. Your spouse/partner and dependents’ first and last names, dates of birth, and contact details where permissible by local law.
Background information. Academic and professional qualifications, education, CV/Resume, credit history and criminal records data (utilized for background check and vetting purposes where permissible and in accordance with applicable law and consultation requirements).
Financial information. Bank account details, tax information, salary, retirement account information, superannuation fund details, company allowances and other information necessary to administer payroll, taxes and benefits.
Workplace, Device, Usage, and Content data. Emails sent and received, building and information system access, device, system and application usage when accessing and using corporate buildings, ships, services and assets.
Background Checks. We may also collect personal information about you from third parties or public sources as needed to support the employment relationship, including through lawful background screenings, to the extent permitted by law, through a third- party vendor for information about your past education, employment, credit and criminal history, and adverse online and media events, including those concerning crime, terror, fraud or other illicit activities.
Location and Movement Data. If you are staffed on a MedallionClass™ ship or property, your position and movement information collected through sensors and readers located throughout ships and in certain resorts which emit a signal that detects the presence of the Medallion^® wearable device, creating a record of your position and movements. Similar information may be collected through the OceanOrbit™ wearable device technology. We will also collect your position and movement information through the Hub app or other branded app required for your duties. The Hub app will track the position and movement of Staff and Crew who are under an active contract while they are not aboard their assigned ship.
Social Media and other Third-Party-Sourced Data. In the event of a natural disaster or other life/safety emergency, we may rely on public social media posts or other public sources to account for Staff and Crew if otherwise unable to contact them. Additionally, if there is an investigation of a Staff and Crew matter, we may obtain information relevant to the incident from external sources including private parties, law enforcement or public sources like news sources and public social media posts.

Special Categories of Personal Information

We do not process special categories of personal information (also referred to as “sensitive personal information” or “sensitive data”) about you except where we are permitted to do so under applicable law such as where there is a legal reason to do so, either as part of your contract of employment, where we are under an obligation to process that data, where we have given you notice of such processing in our legitimate business interests, or where you have otherwise consented or asked us to do so. Categories of personal information deemed to be sensitive may differ depending on your jurisdiction residency, and may include data such as:

Racial or Ethnic Origin, which may be revealed by personal details or by photographs processed for organizational or operational reasons (e.g. company security pass), religious beliefs, if you have requested to observe religious holidays other than in accordance with the law other than those set out in our employee handbook.
Trade Union Membership, if you have requested that we withhold trade union membership fees from your wages or you hold, or are a candidate for, a position as a trade union officer.
Membership of a Political Party, if you hold a publicly elected office or work at a polling station as a party-appointed scrutineer.
Philosophical Beliefs, with specific regard to conscientious objection to military service or information on religious affiliation where this is required for tax purposes.
Health Data, which may be information from the provision and referral of care by Carnival medical services, a Staff and Crew member’s health status as determined by the contracted physical and Carnival’s health facilities, in any event managed by doctors bound by professional secrecy, or about the Staff and Crew member’s physiological or medical state, including information on disabilities, illnesses, medical symptoms, temperature checks, medical examination records, medical histories, attestations of health status, vaccinations, contact tracing history, medical certificates justifying absences, fitness to work, certificates, including occupational health and safety certificates and maternity certificates, maternity or paternity leave, documents or status, and records regarding injuries and industrial accident insurance.
Images and Biometric Information, including photos, images and videos collected through CCTV cameras, on-board photographers, unique facial recognition identifiers, and fingerprint scans that can recognize you and be used to confirm your identity. The ID verification may occur where additional security is needed, such as during boarding and disembarkation, on- board casino staff, and staff handling cash payouts. We may also process your fingerprints in the context of secure computer access in lieu of, or in addition to, IT passwords.
Precise Geolocation, including position and movement information collected through the Hub app or other branded app required for your duties, or, if you are staffed on a MedallionClass™ vessel or property, through sensors and readers located throughout ships and in certain resorts which emit a signal that detects the presence of the Medallion^® or OceanOrbit™ wearable device.
Government Identifiers, including passport numbers, driver’s license numbers, social security or other tax ID numbers, or any other government-issued unique identifier.
Usernames and Passwords, you use to securely log into your employment-related accounts with us.
Payment Cards and Financial Accounts, including any company credit cards and payroll linked financial accounts.
Criminal Convictions, Offenses and Pending Criminal Charges, where required by the law for the purposes of employment and for management of the Contract of Employment or for assessment of the Staff and Crew member’s professional aptitude.

Purposes of Personal Information Processing

The processing of your personal information and those of your family members, including special categories of such data, is carried out for the following purposes and in accordance with the following legal basis:

Administer and Manage the Contract of Employment. The personal information provided for the employment contract will be processed in order to:
Fulfill obligations arising from the employment contract of and associated legal obligations (e.g. payment of wages, payment of social security contributions, preparation of paychecks, management of annual leave, documents justifying absences, provision of benefit plans and programs, etc.);
Carry out the organizational management of your work, as well as for Carnival’s operational/management demands, such as creation of job descriptions for the corporate Intranet, collection and retention of information that is useful for your career advancement (e.g. your educational record, training courses attended, knowledge of foreign languages, previous work experience), internal auditing and risk management activities etc.
Security and Monitoring. The personal information will also be processed for security purposes, protection of Carnival property (including intellectual property) and prevention and investigation of crime, abscondment or other dereliction of duty, partly by means of inspections (e.g. internal audits), electronic surveillance including biometric identifiers, social media monitoring and/or location and movement tracking, closed circuit cameras (CCTV) as well as tools for reporting misconduct to the competent corporate bodies (e.g. compliance website and hotline). The primary purpose of this monitoring is to protect Carnival, its employees, staff, crew, passengers and partners, for example:
For network and device management and support;
- For proof of business transactions and recordkeeping;
- For security and the protection of confidential information and Carnival assets;For public health and safety reasons;
- For investigating wrongful acts or allegations or potential violations of Carnival policy; and
- For other legitimate business purposes as permitted under applicable law.

You are informed that the security checks and other means of monitoring entrances to Carnival’s head office, ships and other premises, as well as associated inspections, internal auditing and reporting of misconduct, will be carried out in full compliance with the principle of necessity and, where applicable, with the prohibition on the use of cameras to monitor the work of Staff and Crew. Image data will only be processed by persons expressly authorized to this end and only be stored for the time strictly necessary for the aforementioned security purposes, or for any longer periods laid down in specific trade union agreements or stipulated by judicial authorities.

Other Overriding and Legitimate Business Purposes. We also may process your personal information when it is necessary for other legitimate purposes, such as general HR administration, general business management and operations, disclosures for auditing and reporting purposes, management of network and information systems security and business operations, provision and improvement of employee services, physical security and to protect the life, health and safety of Staff and Crew, guests and others. We may also use special applications and systems that record Staff and Crew performance metrics, such as sales-related or code databases for business operations purposes, as well as for the purposes of reviewing, rewarding and coaching Staff and Crew on their performance. We may also process your personal information to investigate potential violations of law or breaches of our internal policies.
Legally Required Purposes. We may process your personal information when we consider it necessary for complying with laws and regulations, including collecting and disclosing personal information as required by law (e.g., for minimum wage, working time, tax, health and safety, social security, anti-discrimination laws, global migration), under judicial authorization, or to exercise or defend our legal rights.
Purposes Related to Health Data. We generally use health data for the following purposes:
Health and Safety. Your health data will be used to protect the health and safety of you, other Staff and Crew, our guests, and the public at large. We may also combine health data with location information, where available, for contact tracing purposes in the event of a communicable disease outbreak or other health and safety hazard.
Legal and Regulatory Compliance. We may be subject to national or international laws, regulations or orders that require us to process your health data, generally for public health reasons including to track and mitigate risks of communicable diseases and illnesses and comply with applicable work health and safety related obligations.
Staff and Crew Management. Your health data will be used to ensure compatibility between your personal health – including that of your family members – and assigned duties, within the confines of applicable law.
Purposes Related to the Use of your Facial Image. We may use your image (e.g. in photos or video) or biometric facial recognition identifiers, for the following purposes:
- Security Purposes. Your photograph will appear on your Carnival security pass. These passes are used to monitor access and to enable the ready identification of all persons on the premises and ships. We may also use facial recognition technologies or other biometric data to verify identity, for authorization and security purposes, and to manage our workforce, particularly during the boarding and disembarkation processes. Unique facial identifiers will be destroyed when the purpose for collecting the identifiers has

been satisfied or within three years of your last interaction with us, though images (such as photos or videos) may be retained longer in a manner consistent with our corporate retention schedule and legal requirements.

Organizational and Operational Purposes. Your photograph may be posted on the corporate Intranet, for the ready identification of job descriptions and for applying for government visas or a Seaman’s book.
Advertising. Your photograph may be published in Carnival magazines and promotional material in connection with and/or during events in which you may take part. You will generally be given the ability to not participate in such filming or the use of your image in advertising and promotional materials, should you prefer so.
Background Checks. Your photograph may be provided to entities for the purposes of conducting a background check prior to an offer of employment being made.

How and Why We Share Personal Information

To facilitate the employment process or execute the contract of employment and/or to comply with the associated contractual and legal requirements. Failure to provide the personal information may make it impossible to execute or fulfil the employment or service contract or to fulfill some or all of the associated contractual and legal requirements. Carnival will only share your personal information with those who have a legitimate need for it. Wherever we permit a third party to access personal information, we will make sure the data is used in a manner consistent with this notice (and any internal data handling guidelines consistent with the sensitivity and classification of the data.). Your personal information may be shared with our subsidiaries and affiliates and other third parties, including service providers, for legitimate purpose including but not limited to as follows: In order to carry out the uses of personal information described above;
To enable third parties to provide services to us. Categories of recipients of data would include insurance providers, benefit enrollment vendors, leave of absence administration vendors, payroll support services, relocation, tax and travel management services, health and safety experts, and manning agents, such as Global Talent Partners;
To comply with our legal obligations, regulations or contracts, or to respond to a court order, administrative or judicial process, such as a subpoena, government audit or search warrant. Categories of recipients would include counter-parties to contracts, judicial and governmental bodies;
In response to lawful requests by public authorities (such as national security, public health matter or law enforcement); we reserve the right to cooperate with these bodies also on a voluntary basis where appropriate and where we believe we have a legal justification for doing so;
To seek legal advice from external lawyers and advice from other professional advisers such as accountants, management consultants, etc.;
As necessary to establish, exercise or defend against potential, threatened or actual litigation (such as adverse parties in litigation);
Where necessary to protect Carnival, your vital interests, or those of another person;
In connection with the sale, assignment or other transfer of all or part of our business (such as a potential purchaser and its legal / professional advisers); and
Otherwise in accordance with your consent.

Please note we do not sell the personal information of Staff or Crew or their related persons, and we do not share or otherwise disclose such personal information to third parties for the purpose of displaying advertisements that are selected based on personal information obtained or inferred over time from an individual’s activities across businesses or distinctly-branded websites, applications, or other services (otherwise known as “targeted advertising” or “cross- context behavioral advertising”).

Where We Store and Process Personal Information

Carnival operates at the global level and therefore personal information may need to be transferred to countries outside of where it was originally collected. For example, because we are headquartered in the United States, information collected in other countries is routinely transferred to the United States for processing. When we transfer your personal information to another country, we will ensure that this transfer complies with applicable laws and legislation. Carnival has Standard Contractual Clauses in place for the collection, use, and retention of personal information transferred from the European Economic Area (“EEA”), the United Kingdom and Switzerland to other countries which have been approved by the European Commission. This data is only transferred to other Carnival Group companies and/or to third party service providers, and only for the aforementioned purposes. You may request a copy of the applicable safeguards by contacting the Data Protection Officer using the contact information below.

Security of your Personal Information

Carnival is committed to protecting the security of your personal information. We will use a variety of security technologies and procedures to help protect your personal information from unauthorized access, use, or disclosure. For example, we store the personal information you provide on computer servers with limited access that are located in controlled facilities, and

when we transfer certain highly confidential or sensitive personal information, we protect it through the use of encryption.

Retention Period

Personal information will be stored according to applicable laws or regulatory requirements and kept as long as is necessary to fulfill the purposes for which the personal information was collected. Generally, this means that your personal information will be retained as documented in our corporate retention schedule and applicable riders and supplements.

Change of Purpose

We will only use your personal information for the purposes outlined in this notice or such purposes as may be reasonably compatible with the original purpose for which it was collected or there is an alternative legal basis for the further processing.

Changes to this Privacy Notice

We may occasionally update this Privacy Notice. When we do, we will revise the “last updated” date at the top of the Privacy Notice. If there are material changes to this notice or in how Carnival will use your personal information, we will use reasonable efforts to notify you whether by prominently posting a notice of such changes before they take effect or by directly sending you a notification. We encourage you to periodically review this privacy statement to learn how Carnival is processing your personal information.

How to Contact Us

If you have any questions about this Privacy Notice, please contact the Data Protection Officer at:

Mail: Carnival Privacy Office Attn: Data Protection Officer 3655 NW 87th Avenue, Miami, FL 33178-2418

Email: Privacy@Carnival.com

Data Controller. The Data Controller is the subsidiary or affiliated entity of Carnival Corporation that determines how (and for what purpose) your personal information is used. The primary Data Controller of data processed subject to this Privacy Notice is the Carnival entity you have a contractual relationship with. Other Data Controllers that may access and process your personal information processed under this privacy notice include Carnival Corporation, Carnival plc, Princess Cruise Lines, Ltd., Holland America Line N.V., in its capacity as general partner of Cruiseport Curacao C.V., Seabourn Cruise Line Limited, Carnival plc trading Carnival Australia, Carnival plc trading as Carnival New Zealand, HAL Maritime Limited, HAL Beheer B.V., Navitrans

B.V., Marine Manpower Services (Guernsey) LTD, Carnival Japan Inc., Cunard Celtic Ltd., Fleet Maritime Services (Bermuda), Ltd., HAL Properties Limited, Holland America Line Inc., Princess Cays Limited, Royal Hyway Tours, Inc., Tour Alaska LLC, Westmark Hotels of Canada Ltd., Westmark Hotels, Inc., Carnival Corporation Hong Kong Limited, Carnival Corporation Korea Ltd., Global Shipping Service (Shanghai) Co., Ltd., Carnival plc (Singapore Branch), Carnival plc Taiwan Branch, UK Carnival plc Cruises Beijing Representative Office, UK Carnival plc Cruises Chengdu Representative Office, UK Carnival plc Guangzhou Representative Office, and UK Carnival plc Shanghai Representative Office. Please see the “How and Why we Share Personal Information” Section above for more information about how we share personal data amongst the Data Controllers.

California Residents

Your Data Subject Rights. In addition to the information shared above, Staff, Crew and individuals who reside in the state of California may have certain rights, subject to limitations at law, including:

Right to Know. You have the right to know whether we are processing any personal information about you and to obtain certain personalized details about the personal information we have collected about you, including: the categories or specific pieces of personal information we have collected about you; the categories of sources of the personal information; the categories of personal information that we have sold or disclosed to third parties for a business purpose, and the categories of recipients to whom personal information was shared, sold or disclosed; and the business or commercial purposes for collecting or selling the personal information;
Request Access. You have the right to request access to the personal information we have collected about you and, where required by law, the right to obtain a copy of the personal information;
Right to Portability. You have the right, in certain circumstances, to receive a copy of the personal information you have provided to us in a structured, commonly used, machine- readable format that supports re-use, or to request the transfer of your personal information to another person;
Right to Correction. You have the right to correct inaccuracies in your personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information;
Right to Limit Use and Sharing of Sensitive Personal Information. You have the right to exercise control over our collection and processing of certain sensitive information.
Request Deletion. You have the right to request that we erase the personal information we have collected from you, subject to certain exceptions.

You also have the right to not receive retaliatory or discriminatory treatment in connection with a request to exercise the above rights. However, please note that if the exercise of these rights limits our ability to process personal information, we may no longer be able to engage with you in the same manner.

To make a request to exercise one of the above rights, please contact privacy@carnival.com or send a request through your HR department. In some cases, you can access your data and correct or update your information directly through our HR information systems. We will consider and act upon any requests in accordance with applicable data protection laws. Please note that we may request specific information from you to enable us to confirm your identity and right to access, as well as to search for and provide you with the personal information that we hold about you. We may, in limited circumstances, charge you a reasonable fee to access your personal information; however, we will advise you of any fee in advance.

If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time. Please note, however, that this will not affect the lawfulness of the processing before its withdrawal, and we may no longer be able to engage with you in the same manner.

In certain circumstances, you are permitted to use an authorized agent to submit requests on your behalf through the designated methods set forth above where we can verify the authorized agent’s authority to act on your behalf. In order to verify the authorized agent’s authority, we generally require evidence of either (i) a valid power of attorney or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a statement of authorization for the request. Depending on the evidence provided, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to verify your identity in connection with the request.

European Staff and Crew

Your Data Subject Rights. In addition to the information shared above, Staff, Crew and individuals within the European Economic Area (“EEA”), the United Kingdom and Switzerland may have certain rights under applicable data protection laws, including the EU General Data Protection Regulation and local legal implementation of that Regulation, which include the rights to:

Request Access. You have the right to obtain access to your personal information. This includes the right to obtain confirmation of whether we are processing your personal information; information about the categories of personal information we are processing, the purposes for which we process your personal information and information as to how we determine applicable retention periods; information about the categories of recipients with whom we may share your personal information and if those recipients are located in third countries; and a copy of the personal information we hold about you;
Right of Portability. You have the right, in certain circumstances, to receive a copy of the personal information you have provided to us in a structured, commonly used, machine- readable format that supports re-use, or to request the transfer of your personal information to another person;
Request Rectification. You have the right to obtain rectification of any inaccurate or incomplete personal information we hold about you without undue delay;
Request Erasure (or Deletion) of Personal Information: You have the right to require us to erase your personal information without undue delay if the continued processing of that personal information is not justified;
Restrict Data Processing: You have the right to require us to limit the purposes for which we process your personal information (for example, where the accuracy of the personal data is contested by you), for a period of time that enables us to verify the accuracy of that personal data; and
OBJECT: You also have the right to object to any processing based on our legitimate interests, at any time, where your objection is raised on grounds relating to your particular situation. Should you decide to object to the processing of your personal data, we will stop processing personal data concerning you, unless we can demonstrate compelling reasons for continuing to process your personal data that override your interests, rights and freedoms, or where we process your personal data to establish, exercise, or defend our legal claims.

Application of the above rights may vary depending on the type of data involved, and Carnival’s particular legal basis for processing the personal information.

To make a request to exercise one of the above rights, please

contact privacy@carnival.com. We will consider and act upon any requests in accordance with applicable data protection laws. Please note that we may request specific information from you to enable us to confirm your identity and right to access, as well as to search for and provide you with the personal information that we hold about you. We may, in limited circumstances, charge you a reasonable fee to access your personal information; however, we will advise you of any fee in advance.

You may also direct questions about how we handle personal information to the Data Protection Officer at privacy@carnival.com. While Carnival hopes it can answer any questions that you may have, if you have unresolved concerns you also have the right to complain to a relevant data protection supervisory authority in the EU. If you are based in the European Union, information about how to contact your local data protection authority is

available here . If you are based in the United Kingdom, your local data protection authority is the Information Commissioner’s Office, which can be contacted here .

Staff and Crew in Canada

Location of Processing. We and our respective service providers store and process personal data outside of Canada. The countries to which we transfer personal data may not provide you with the same legal protections you have under federal, provincial and territorial laws of Canada. However, we have implemented appropriate safeguards, including contractual requirements, to secure the transfer of your personal information.

Your Data Subject Rights. Staff and Crew may have certain rights under applicable data protection laws, which include the rights to:

Request Access. You have the right to obtain access to your personal information. This includes the right to obtain confirmation of whether we are processing your personal information; information about the categories of personal information we are processing, the purposes for which we process your personal information and information as to how we determine applicable retention periods; information about the categories of recipients with whom we may share your personal information and if those recipients are located in third countries; and a copy of the personal information we hold about you;
Right of Portability. In limited circumstances, you may have the right, in certain provinces, to receive a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format that supports re-use, or to request the transfer of your personal information to another person;
Request Correction. You have the right to obtain correction of any inaccurate or incomplete personal information we hold about you; and
Request Deletion of Personal Information: You have the right to request deletion of personal information if the personal information is not required for the purposes for which it was collected.

Application of the above rights may vary depending on the type of data involved, and Carnival’s particular legal basis for processing the personal information.

To make a request to exercise one of the above rights, please

You may also direct questions about how we handle personal information to the Data Protection Officer at privacy@carnival.com.

Staff and Crew in China

Your Data Subject Rights. In addition to the information shared above, Staff, Crew and individuals in the People’s Republic of China (excluding Hong Kong, Macau and Taiwan,

the “PRC”) may have certain rights under applicable data protection laws, including the PRC’s Personal Information Protection Law, which include the rights to:

Right to Know and Decide. You have the right to know and to decide about processing of your personal information unless the law provides otherwise. For example, we may be obligated by law to keep certain information confidential or may be exempted from notification under certain circumstances. You also have the right to request us to explain our rules on processing your personal information.
Right to Restrict or Object. You have the right to restrict or object to any processing of your personal information unless the law provides otherwise. For example, you may not be able to restrict or object to processing that is made on a legal basis other than your consent.
Right to Access and Reproduce. You have the right to access your personal information or to obtain a copy of your personal information unless we are obligated by law to keep certain information confidential.
Right to Transfer. You have the right to transfer your personal information to another processor appointed by you, provided that the transfer meets the requirements set forth by the Cyberspace Administration of China (the “CAC”).
Right to Rectify and Supplement. You have the right to have your personal information rectified or supplemented where that personal information is inaccurate or incomplete.
Right to Erase. You have the right to request the erasure of your personal information. However, if we are obligated by law to retain your personal information for a longer period of time, or it is technically unfeasible to erase your personal information, we will retain your personal information with necessary security protection measures and will not otherwise process your personal information.

In some cases, our ability to uphold these rights for you may depend upon our obligations to process personal information for security, safety, fraud prevention reasons, compliance with regulatory or legal requirements, or because processing is necessary to deliver the services you have requested. Where this is the case, we will inform you of specific details in response to your request.

Please also note that after an individual passed away, their next of kin may be able to exercise the individual rights of the deceased in accordance with law.

To make a request to exercise one of the above rights, please contact privacy@carnival.com. You may also direct questions about how we handle personal information to the Data Protection Officer at privacy@carnival.com. We will consider and act upon any requests in accordance with applicable data protection laws. Please note that we may request specific information from you to enable us to confirm your identity and right to access, as well as to search for and provide you with the personal information that we hold about you. We may, in limited circumstances, charge you a reasonable fee to access your personal information; however, we will advise you of any fee in advance.

Personal Information Processor. The primary Personal Information Processor of your data under this Privacy Notice is the Carnival entity you have a contractual relationship with. Other Personal Information Processors that may access and process your personal information for the purposes described in this privacy notice include the entities listed above under “Data Controllers.”

Staff and Crew in Indonesia

Your Data Subject Rights. In addition to the information shared above, Indonesian Staff and Crew, Staff and Crew, as well as individuals in the Republic of Indonesia may have certain rights under the applicable data protection laws, including the Republic of Indonesia No. 27 of 2022 on Personal Data Protection (as may be amended from time to time) and its implementing regulations, which include the rights to:

Right to be informed. You have the right to be informed about Carnival’s identity and accountability, the purposes of personal data processing, and the lawful bases for such processing.
Right to access. You have the right to request and obtain access to your personal data that we hold at any time, including obtaining a copy of such data.
Right to rectification. You have the right to request to complete, update, and/or rectify any errors or inaccuracies in your personal data.
Right to terminate processing (including deletion and destruction). You have the right to request termination of processing, deletion, and/or destruction of your personal data.
Right to withdraw consent. You have the right to withdraw the consent that you have previously given (if your personal data is processed on the basis of your consent) at any time.
Right to restriction. You have the right to request the suspension or restriction of the processing of your personal data.
Right to data portability. You have the right to request and/or use your personal data in a form that is accordance with the structure and or format commonly used and/or readable by an electronic system. You also have the right to request that your personal data be moved or transferred from our system to another system, where it is technically and securely feasible.
Right to complaint. You have the right to file a complaint if you have reason to believe that we have violated the applicable data protection laws.

To make a request to exercise one of the above rights, please contact privacy@carnival.com. We will consider and act upon any requests in accordance with applicable data protection laws. Please note that we may request specific information from you to enable us to confirm your identity and right to access, as well as to search for and provide you with the personal information that we hold about you. We may, in limited circumstances and as permitted by applicable laws and regulations, charge you a reasonable fee to access your personal information; however, we will advise you of any fee in advance.

Special Categories of Personal Information. ‘Special categories of personal information’, ‘sensitive personal information, or ‘sensitive data’ includes (i) health data and information, (ii) biometric data, (iii) genetic data, (iv) criminal records, (v) children’s data, (vi) personal financial data, and/or (vii) other data in accordance with the provisions of the laws of the Republic of Indonesia. We may use sensitive information for the purposes set forth in the What Information We Collect, Special Categories of Personal Information and Purpose of Personal Information Processing sections of this Privacy Notice.

Children refer to individuals under the age of 18 and unmarried.

Collection of Dependent’s Data. You may only provide us with the personal data of your dependents, such as your spouse or children, if you are authorized to disclose such data to us.

Personal Data of Children. Before processing personal data of your children for the purposes stated herein, we will seek consent from you as their parent or legal guardian in accordance with the applicable laws and regulations.

In the event that you provide us with personal data of children for the purposes stated herein, we will process such data in a manner consistent with applicable laws and regulations protecting the privacy of children’s data.

Personal Data of People with Disabilities. Before processing personal data of any person with disabilities, we will seek consent from them or their legal guardian in accordance with the applicable laws and regulations.

Transfers. We may transfer your personal information to countries located outside Indonesia. In transferring personal information out of your country of residence, we will:

ensure that the country where the transferee is domiciled has a level of personal data protection that is equivalent to or higher than that stipulated in Law of the Republic of Indonesia No. 27 of 2022 on Personal Data Protection (as may be amended from time to time) and its implementing regulations;
in the event that letter a above is not fulfilled, we will ensure that there is adequate and binding personal data protection; or
in the event that letter a and b above are not fulfilled, we will ask for your consent.

Changes to this Privacy Notice. The provisions regarding “Changes to this Privacy Notice” above apply, except in cases where required by the applicable laws and regulations, such as changes to the purpose for processing of personal data stipulated herein, we will ask for your consent before applying the changes, and new changes to this Privacy Notice will take effect from the date of your consent.

Staff and Crew in New Zealand

This section applies to you if any of our New Zealand entities or entities that are subject to the Privacy Act 2020 (New Zealand) (the “NZPA”) collect, hold or use or disclose all or any part of your personal information.

Your Rights. You have the right to request access to, or correction of, your personal information. If you wish to request access to, or correction of, your personal information, please contact us by sending an email to privacy@carnival.com.

Foreign Disclosures. We may from time to time disclose or transfer your personal information to persons located in countries outside of New Zealand. By providing your personal information to us, you consent to the transfer and/or disclosure of your personal information to persons located in countries other than New Zealand and the use, processing, storage and disclosure of your personal information by such persons and in such countries and acknowledge that such persons may not be required to protect your personal information in a way that, overall, provides comparable safeguards to those in the NZPA.